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RISK Management 


Risk management at Maersk is strategically focused and designed to 
contribute to the achievement of the company’s business objectives 
in the medium term and to ensure the longevity of the company in 
the longer term. 


Transforming Maersk to become the global integrator of container 
logistics is a complex process, which carries multiple risks. It is essential 
that risks associated with the transformation and risks inherent to our 
business activities are managed well to keep the potential financial and 
reputational impact of such risks within acceptable levels. 
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Risk identification 
Risks are continuously 
identified and reported 
using uniform templates 
and tools 
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Risk monitoring Risk assessment 
Development of key risks A. p M O le [- M de rsk Identified risks are 
risk Management 


and mitigation actions are analysed and assessed 
monitored by risk deep- to determine triggers, 
dives and reporting impact and likelihood 
process 
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Risk mitigation Risk recording 
Risk mitigation action plans Key risks are established, 
are prepared and implemented prioritised and documented, 
across the affected businesses and risk owners are appointed 


Effective risk management is key to growing sus- 
tainably in an increasingly volatile and uncertain 
business. The Board of Directors is responsible for 
overseeing risk management. The Board of Direc- 
tors determines the framework for management 
of risks, including risk appetite. The Audit Commit- 
tee monitors the execution of the risk manage- 
ment processes and the management of key risks. 
The Executive Board is responsible for overseeing 
day-to-day risk management. 


Risk management process 

Each year, the Executive Leadership Team decides 
the key risks to the business plan. In preparation 
for the discussion in the Executive Leadership Team 
a comprehensive risk assessment takes place. 


The Executive Leadership Team appoints a risk 
owner (an Executive Leadership Team member) 
for each key risk to oversee the management of 
the risk, including the preparation and execution 
of mitigation action plans. Once the plans for the 
management of the risks are finalised, the risk 
owner presents and discusses such plans with the 
Executive Leadership Team and the Audit Commit- 
tee in designated risk deep-dive sessions. 


The risk management function monitors the sta- 
tus of each key risk, including the progress and 
effect of the mitigation action plans, and summa- 
rises the status in quarterly reports to the Execu- 
tive Leadership Team. Where the progress of miti- 
gating actions is falling behind schedule, or where 
mitigating actions are not achieving the effect 
they were designed to have, the report will high- 
light this, so that corrective action can be taken. 


The latest risk assessment was carried out in H2 
2019. It identified 10 key risks that may have a sig- 
nificant impact on the business plan, including 


Risk management 


on earnings, financial position and achievement 
of other strategic objectives. It also identified 
key emerging risks that look beyond the business 
planning period and are threats to the business 
value drivers 


The Coronavirus (COVID-19) 


The outbreak of the COVID-19 in China 
introduces additional challenges and 
risks to Maersk's operations. Maersk has 
already undertaken specific measures 
to ensure the health and safety of its 
employees globally. In addition to human 
risk, the outbreak of the virus also poses 
an economic risk to Maersk’'s operations 
and its trade volumes. 


Fear of the virus and the efforts to pre- 
vent its spread will see an increasing 
pressure on the supply-demand bal- 
ance. It is expected that the COVID-19 
could dampen 2020 volumes, due to the 
extension of the Chinese New Year hol- 
idays and emergency measures to curb 
the spread of the virus. It is still early 
days to measure the overall impact, 
however, the weekly container vessel 
calls at key Chinese ports were signif- 
icantly down compared last year dur- 
ing the last weeks of January and the 
first weeks of February. Freight rates are 
expected to decrease due to dropping 
demand for containerised goods trans- 
port. Also, the outbreak has led to delays 
in opening of Chinese shipping yards 
following the Chinese New Year holidays, 
which has delayed yard works planned, 
including some planned installations of 
scrubbers on Maersk vessels. 
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2020 Key risk analysis 


The key risks to achieving Maersk's 2020-2024 business 
plan, the assessment of each risk, the mitigation strategies 
deployed, and the development in the risk landscape since 
2019 are described in the following. 


High Risk 
1. Ocean strategy 
2. IMO 2020 
3. Cost excellence 
4. Cyber security 
5. Logistics & Services strategy 
6. Compliance 
7. Technology platforms 
2 i, 1 8. Core business processes 
5 yi fla 9. APM Terminals transformation 
eo ue > y 1 ts 10. Human resources 
: Nee 
= 10 Y 
= 9 ve m 2020 position 
I n_¢ : 2019 position 
Rn y m@ 2020 new risk 
6 7 
Low Financial or reputational impact High 


All positions are residual risk after mitigation. 


] Failure of Ocean strategy 


Risk description 

The Ocean business remains volatile and there is 

a need to de-commoditise it to stabilise earnings. 
De-commoditising the Ocean business is a prerequi- 
site for generating the earnings required to fund the 
transformation of the company and delivering on the 
integrator strategy. 


2020 Risk assessment 

In order for the Ocean business to be stable it must 
be de-commoditised. In the current state of the 
container liner industry, most players are price takers 
almost entirely dependent on supply and demand. 
There is a need to differentiate Maersk's Ocean busi- 
ness by providing added value propositions to cus- 
tomers through development of different Ocean 
products. 


Mitigation strategies 

Maersk pursues a strategy of de-commoditisation of 
the Ocean business through Maersk Spot and other 
Ocean products in combination with modest volume 
growth and CAPEX discipline. 


Risk management 


Failure to implement IMO 2020 
strategy for mitigating cost impact 


Risk description 

The existing compliant fuels, and new fuels devel- 
oped to comply with IMO 2020 regulation, cost more 
than HSFO bunkers, implying fuel cost increases in 
2020. Alternative compliance methods, like scrub- 
bers, will enable the use of high-sulphur fuels at a 
lower cost but requires additional CAPEX. 


In the short term, the risk is that Maersk will not be 
able to recover the additional cost from its customers. 


2020 Risk assessment 
The impact of the risk will depend on the extent 
to which: 
a price spread exists between high sulphur-fuels 
and compliant fuels, 
competitors have more cost effective compliance 
strategies than Maersk, 
IMO 2020 enforcement may allow some com- 
petitors to avoid the higher fuel bill, and 
demand-supply balance makes recovery of the 
added cost difficult. 


Compared to 2019, the risk has reduced as competi- 
tors seem to have prepared for compliance. There is 
a strong push for enforcement through levy of dis- 
suasive fines and tendered contracts are being con- 
cluded with new bunker adjustment factor clauses. 


Mitigation strategies 

Maersk seeks to recover the added cost of low sul- 
phur fuel from customers and has a strategy for mit- 
igating the cost through a mix of various initiatives 
such as installation of scrubbers on selected vessels 
and increased fuel efficiency. 
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Losing cost discipline in Ocean as 
Maersk implements the integrator 
strategy 


Risk description 

Remaining competitive and generating the earnings 
required to fund the transformation and deliver on 
the integrator strategy requires strict focus on costs 
in Maersk’s Ocean business. Maersk must not lose 
focus on cost leadership as it implements its inte- 
grator strategy. 


2020 Risk assessment 

Transforming into a global integrator of container 
logistics requires additional focus to build land-based 
products and become a customer led organisation. 
This might entail some dilemmas in the Ocean busi- 
ness, including in respect of cost excellence, as the 
product offering broadens and flexibility towards 
customers is required. Careful balancing will be 
needed. 


Mitigation strategies 

Maersk has reorganised the company to gather 
responsibility for Ocean and Logistics & Services, 
including for commercial and operational aspects 
under one leadership. This enables a balanced and 
holistic decision-making in respect of transforming 
and performing at the same time. Furthermore, 
a multi-year cost excellence programme including 
moving to zero-based budgeting has been intro- 
duced to ensure a dynamic adoption of the cost 
base in the transforming business. 


vA Being hit by a major cyber-attack 


Risk description 

As Maersk becomes increasingly digitalised, more 
devices and control systems are connected online 
resulting in a wider surface across the Information 
Technology (IT) and Operational Technology (OT) 
infrastructure that could be compromised. 


Should a successful cyber-attack materialise, the 
services that allow the organisation to continue to 
operate could be compromised resulting in opera- 
tional disruption. Further, a cyber-attack could cause 
a data breach where sensitive, protected or confi- 
dential data held by Maersk is leaked or stolen. 


2020 Risk assessment 

Following the cyber-attack in 2017, several measures 
to improve cyber security have been implemented 
with an enhanced security posture as a result. A 
cyber-attack causing operational disruption could 
still happen due to e.g. new malware outbreak not 
specifically targeted at Maersk, a targeted attack 
on one or more brands within Maersk, a disgruntled 
employee or malicious third-party contractor, or an 
accidental employee action. 


Mitigation strategies 

Improving and strengthening cyber security is a stra- 
tegic priority for Maersk and this includes execution 
of a comprehensive cyber security plan, a three-level 
assurance model to maintain oversight and obtain 
confidence that the communicated level of cyber 
capability is reflective of reality, implementation of 
business continuity plans, and purchase of cyber 
risk insurance. 


Full implementation of the cyber security plan is 
expected to be completed by the end of 2020. 


Failure to build a strong Logistics & 
Services business in the coming years 


Risk description 

A cornerstone in Maersk’'s strategy is to expand its 
product offering to the customers into land-based 
Logistics & Services products to further diversify the 
overall business and earnings. The risk is that Maersk 
fails to translate its Logistics & Services strategy into 
a profitable long-term business. 


2020 Risk assessment 

By consolidating its Logistics & Services activities, 
Maersk has a focused platform to offer customers 
products covering the end-to-end supply chain. 
Achieving profitable Logistics & Services growth calls 
for capable core business processes and digital plat- 
forms, strong capabilities in the frontline to sell the 
new products, and the ability to counter competing 
automated supply chain management platforms. 


Mitigation strategies 

The main mitigating strategies pursued are to build 
a global, competitive end-to-end product portfolio, 
integrate those products and services at a data, oper- 
ational and strategic level to fit customer needs, and 
establish a global sales team with the knowledge 
necessary to sell the whole Maersk portfolio from 

a vertical perspective. 


Anew function is being established to assess, design 
and implement changes related to products, pro- 
cesses and master data throughout the business. 


Risk management 


6 Being hit by a large compliance case 


Risk description 

It is imperative for Maersk to conduct its business in 
compliance with legislation and regulatory standards. 
The risk is that Maersk is hit by a major compliance 
case in respect of violations of anti-corruption laws 
and standards, competition/anti-trust regulations, or 
international sanctions imposed on countries, enti- 
ties or individuals, resulting in enforcement action 
and/or commercial, reputational and other losses. 


2020 Risk assessment 

In respect of corruption Maersk operates in high-risk 
geographies and high-risk sectors (e.g. the terminals 
and freight forwarding sectors). Maersk is the larg- 
est container carrier and in an industry with many 
industry cooperation agreements. Maersk thereby 
naturally has the attention of competition authori- 
ties globally. There is an increasing number of juris- 
dictions with competition laws in place as well as a 
growing confidence by emerging countries to enforce 
their competition laws against foreign companies. 
International sanctions are becoming increasingly 
widespread and complex and require comprehensive 
and extensive measures to ensure compliance. 


Mitigation strategies 

Maersk has a robust compliance programme for 
anti-corruption, competition law and economic sanc- 
tions and export controls designed to fulfil the global 
requirements and many initiatives are in place to 
improve focus and emphasis on compliance aware- 
ness and training. 


The compliance programme is built upon detailed risk 
assessment and based on that, Maersk has a com- 
prehensive mitigation plan. Maersk has an adequate 
compliance function continuously strengthening the 
compliance programmes and the mitigating meas- 
ures as well as advises the business in respect of 
measures to ensure compliance. Maersk also has a 
whistleblower hotline and other means of reporting 
as part of the compliance programme. 
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Failure to build the industry-leading 
technology platforms of the future 


Risk description 

It is a strategic priority for Maersk to digitalise its 
business model by building the industry leading tech- 
nology platforms of the future that shall address 
customer needs in a connected world and enable the 
company's growth. Such platforms must be effec- 
tively implemented and operated in order for Maersk 
to remain competitive in delivering value to customers. 


2020 Risk assessment 

Whoever is in the front of adopting technological 
development will own the customer relationship. It is, 
therefore, important to secure a digitally based com- 
petitive advantage in Ocean and Logistics & Services. 
Freight forwarders, software companies, supply chain 
management platform companies, and other digital 
players are also advancing in this area. However, 
Maersk has the asset base and geographical foot- 
print to effectively deliver fully integrated end-to- 
end supply chain solutions tailored to the customer's 
needs. 


Mitigation strategies 

Maersk is actively developing and investing in tech- 
nology enabled business platforms. The platforms 
are already creating value for customers, and the 
development and investment continue to further 
improve the customer experience and integrate 
products in end-to-end supply chain solutions 
tailored to the customer's needs. 


Failure to Implement end-to-end 
core processes in Ocean and Logistics 
& Services 


Risk description 

To support the integrator strategy, Maersk needs to 
build end-to-end business processes in Ocean and 
Logistics & Services and modernise its legacy IT land- 
scape to support such processes. 


2020 Risk assessment 

The implementation of the integrator strategy 
depends on core business processes and IT landscapes 
that are fit for that purpose. In order to reap the 
benefits from technology, the end-to-end business 
processes need to be adequately designed, consist- 
ently performed and seamlessly supported by IT. 


Mitigation strategies 

Maersk has launched a programme for modernising 
its legacy IT-landscape to establish a platform and 
solution for performance of end-to-end business 
processes. 


A new function has been established to assess, 
design and implement changes related to products, 
processes and master data. 


Failure to sustainably complete the 
transformation of APM Terminals 


Risk description 

Successfully completing the transformation of APM 
Terminals is strategically important for Maersk. APM 
Terminals is important in terms of reaching a balance 
in Maersk's overall business by 2023 as Logistics & 
Services and contributes to funding Maersk’'s overall 
transformation. 


2020 Risk assessment 

Key elements of the risk are that the terminals busi- 
ness is exposed to fluctuations in the global econ- 
omy and global trade, several concession agreements 
expire and are up for renewal in the coming years, 
automation of terminals may require negotiation 
with unions and politicians, and APM Terminals has a 
large presence in and dependence on Latin America 
and West Africa. 


Mitigation strategies 

In 2017, APM Terminals launched a transformation 
programme to become ‘The best in class terminal 
operator’ and ensure a strong foundation for future 
growth. Significant progress has been made on the 
transformation till date, and the programme con- 
tinues into the coming years. 
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Risk management 


Lack of organisational capabilities 
to drive the strategy implementation 


Risk description 

The strategy to become a global integrator of con- 
tainer logistics requires new and different capabilities 
in terms of business knowledge, leadership and cul- 
ture. Maersk needs to build the capabilities and cul- 
ture required to transform its business and deliver 
on the integrator strategy, including the ambition 
to build a strong Logistics & Services business. 


2020 Risk assessment 

Comprehensive culture and upskilling programmes 
were launched in 2018 and good progress was made 
during 2019 to strengthen leadership capabilities and 
embedding the culture across the organisation. Still, 
the transformation could be hampered or delayed 
by ineffective capability uplift related to leadership, 
commercial upskilling and inability to insource 
skills or build new ones, especially for executing the 
Logistics & Services strategy. 


Mitigation strategies 

Actions were launched to upscale commercial skills 
and capabilities in cooperation with Maersk's Com- 
mercial Academy and through recruitments and 
acquisitions. New Maersk behaviours and an execu- 
tive development programme have helped support 
culture and leadership. A plan is in place to further 
strengthen the Logistics & Services skills and equip 
the frontline with adequate capabilities to sell inte- 
grated and stand-alone Logistics & Services products. 


6 


A.P. Moller- Maersk Annual Report 2019 


Climate-related financial disclosure 


This page provides an overview of our reporting in line with TCFD recommendations 


The financial sector's increased focus on climate change 
has resulted in requests for companies to report pub- 
licly and comprehensively on climate change strategies 
and risk management. A reporting framework prepared 
by the industry-led Task Force on Climate-related Finan- 
cial Disclosure (TCFD) currently determines best practice 
and reporting leadership. 2019 is the second year where 
Maersk voluntarily reports in accordance with the TCFD 
recommendations. 


The framework requires reporting on both transition risks, 
understood as risks and opportunities from realigning the 
global economic system towards low-carbon or carbon 
neutral solutions, and the impacts on physical risks which 
are risks caused by changes in weather patterns. 


Governance 

Climate-related risks and opportunities are part of 
Maersk's quarterly Enterprise Risk Management system 
reporting to the Executive Leadership Team and the Board 
of Directors. 


Furthermore, Maersk’s transition work, including its CO2 
reduction target and efforts to decarbonise logistics, 
is governed by a task force headed by a member of the 
Executive Leadership Team and ultimately owned by the 
Executive Leadership Team. 


Strategy 

Maersk's strategy is to take leadership in decarbonising 
shipping. It is a high-profile low-CAPEX strategy, as it 
needs a full transition to new net-zero fuels. Especially 
the energy sector is needed to create these solutions, 
and therefore it is crucial to send a clear message to the 
actors that will develop the solutions that we as the end 
consumer are ready to collaborate to identify these fuels. 


Furthermore, it is a key pillar of Maersk’'s strategy to 
involve its customers both as partners in R&D projects, 
but also to already now offer a differentiated net-zero 
ocean transportation product. 


Finally, Maersk works proactively and in partnerships to 
make sure that the right policies will be in place to sup- 
port the transition. More is described in the sustainability 
section on page 27 and in full in our Sustainability Report 
for 2019. 


Risk management 

To protect business value from the risks caused by the 
physical impacts of climate change, Maersk performed 
a hot spot analysis in 2018, estimating the effect of five 
climate hazards (heat stress, floods, cyclones, water 
stress and sea level rise) on ports, other fixed assets and 
strategic commodities within a 2020-2040 timeframe. 


Building on this, we took steps in 2019 to perform an eco- 
nomic analysis and engage with stakeholders in the Pearl 
River Delta in China, which was established as a hot spot. 
Maersk will finalise this analysis and report on it in 2020. 


This work will be instrumental in constantly evolving 
Maersk's approach to manage physical risk from climate 
change in a way that is adequate given the increased 
challenges Maersk will see in the future. 


Maersk's proactive engagement with customers, inves- 
tors and lenders in relation to framework conditions for 
shipping is also part of managing the risk of encountering 
first mover disadvantages. New net-zero fuels will likely 
be more expensive than the current fuels, so for Maersk's 
vision of commercially viable net-zero vessels to be ready 
in 2030, it is crucial to get the right framework conditions 
in place. This is something Maersk both monitors closely 
and works proactively to ensure. 


Metrics and targets 

Approximately two thirds of CO2 emissions are related 

to Maersk's business from its own operations (scope 1) 
and roughly 97% of these come from powering its fleet. 
Indirect emissions that occur in the value chain (scope 3) 
account for approx. one third, while indirect emissions 
from the generation of purchased energy (scope 2) are 
negligible. Consequently, Maersk focuses and measures 
its efforts on decarbonising the sector in which its vessels 
are deployed. 


Maersk’s target is to have net-zero CO2 emissions from its 
own operations by 2050. This will require a commercially 
viable vessel design to be on water in 2030. To decouple 
growth in volume from emissions, Maersk works towards 
a target of 60% reduction in CO2 emissions by 2030, com- 
pared to 2008. Targets for managing the physical impacts 
of climate change are not available yet. 


Risk management 


